Manuel d'utilisation / d'entretien du produit NOC du fabricant Raritan Computer
Aller à la page of 156
CommandCenter ® NOC Administrator Guide Release 5.4 Copyright © 2006 Raritan Computer, Inc. CCNOC-0D-E June 2006 255-80-5301-00.
This page intentionally left blank..
Copyright and Tradem ark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be phot ocopied, reproduced, or tr anslated into another language without express prior written consent of Raritan Computer, Inc.
Safety Guidelines To avoid potentially fatal shock hazard a nd possible damage to Raritan equipm ent: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and ground ing.
F IGURES v Content s Chapter 1: Introduct ion .................................................................. 1 Stand-alone A ppliances ......................................................................................................... ......
vi F IGURES Chapter 3: Configuri ng Intrusion De tection ................................. 45 Configure a Spanned or Mirror ed Port ........................................................................................... 45 Ethernet TAP ...........
F IGURES vii Map Us ers ...................................................................................................................... ...................... 101 Appendix A: S pecificat ions ....................................................
viii F IGURES Configuring a Windows 98/ME box for Remote WM I Management ............................................. 129 Configuring a Windo ws Proxy Details .......................................................................................... 130 Registry Changes [configurat ion]: .
F IGURES ix Figur es Figure 1 Appliance Shutdown/Restart ............................................................................................ .............. 9 Figure 2 Configur e Date and Time ..................................................
x F IGURES Figure 52 Add a Ne w Network Route .............................................................................................. ........... 41 Figure 53 Prune Unus ed Perform ance Da ta ....................................................
F IGURES xi Figure 105 Modify No tification Paths ........................................................................................... .............. 83 Figure 106 Define Escalation in Notifi cation Path ........................................
xii F IGURES.
C HAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC- NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses.
2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CC- SG on www.
C HAPTER 1: INTRODUCTION 3 • Vulnerability Scanning • Event Viewing and Searching • Performance Monitoring per category or device • Integration with CC-SG where CC-SG is notified of events within the subscribed discovery range.
4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) IC MP is used by the CC-NOC to discover devices in your network and is documented in RFC 792 . • In-band – going through the TCP/IP network to control a target by accessing the target directly.
C HAPTER 1: INTRODUCTION 5 • SSO – Single Sign-On. With Single Sign-on ( SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as rem ote authentication has been configured.
6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License typ es include Infrastructure, Server, Workstation, and Promoted Workstation.
C HAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any t ype of device, be it a Windows or non-Windows system. For example, a Linux box whic h is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license.
8 COMMANDCENTER NOC ADMINISTRATOR GUIDE.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 9 Chapter 2: General and Ad vanced Administration Power Down CC-NOC If running CC-NOC on the V1 platform and if it loses AC power while it is up and running, the V1 unit remembers its last power state. Once AC power is restored, the V1 unit automatically reboots.
10 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Date and Time This page allows you to modify the current tim e zone and set the local time or configure a network time protocol (NTP) server with which to synchronize the local time.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 11 Configure Network Connection This page allows you to change the fixed IP a ddress associated with this appliance. This IP address was configured when setting up the initial configuration using a serial connection – see Raritan’s CommandCenter NOC Deployment Guide .
12 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Change the ISP Gateway Address . Figure 4 Configure Network Connection 4. Type the IP address of the ISP gateway or type an address of 0.0.0.0 if you do n o t wish to supply an ISP address. 5. Click save changes .
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 13 email address is a required field and will be used to send status information on t h e CC-NOC itself. 7. Clicking test SMTP settings sends a test email to the email address specified in the Admin Email Address field using the specified SMTP server.
14 COMMANDCENTER NOC ADMINISTRATOR GUIDE WMI management range – see Specifying Windows Management Ranges in Chapter 4: Configuring Windows Management for details. Typically, you woul d want the discovery range specified here to overlap with the WMI management range.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 15 Important! Ensure your discovery range is not too wide, for example, entering multiple Class B address ranges.
16 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Edit the SNMP Ranges . Figure 8 Edit SNMP Ranges 4. Click add new community or edit next to the already defined SNMP range. Figure 9 Defining SNMP Ranges 5. Edit the community string or add a new one. 6.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 17 3. Click Configure Schedule Outages . Figure 10 Configuring Scheduled Outages 4. Type a name for the scheduled outage and click add new scheduled outage . Figure 11 Edit Scheduled Outages 5. Type a name for the scheduled outage.
18 COMMANDCENTER NOC ADMINISTRATOR GUIDE 8. Specify an outage window . For outage windows that are set to Recurring Weekly , you cannot specify outages that start on one day of the w eek and end on a different day.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 19 intervals (they were initially set at 5 minutes for a reason), timeouts and/or retries without proper planning or forethought runs the risk of: • H.
20 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Manage, Unmanage, Rescan, or Delete Devices . Figure 13 Manage, Unmanage, Rescan, or Delete Devices 4.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 21 Configure Perform ance Thresholds This page displays the current values at wh ich SNMP performance metrics ar e considered problematic and events are generated.
22 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Each time you adjust th e performance thresholds, click save thresholds to commit the changes. 5. You can also click reset to restore the threshold values to their pre-set condition. Configure Outage Report This page allows you to view and m odify the working business hours and days for the Outage Report.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 23 SNMP Reparenting Exclusion List This page allows you to specify addresses that should be excluded from SNMP reparenting. This feature is useful if you have multi-interface SNMP devices that have identical IP addresses to other multi-interface devices.
24 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add association . Figure 20 Configure a CommandCenter Secu re Gateway 4. Type an IP address or hostname for the CC-SG. This is a required field. If entering a hostname, it can only contain letters, numbers, periods, or hy phens, and it must begin with either a letter or a number.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 25 Create a CC-SG Peer via a Secure Channel After configuring the CC-SG with CC-NOC information, for example, specifying its IP address, and configuring CC-NOC with CC-SG information, you can create a secure channel between CC- SG and CC-NOC.
26 COMMANDCENTER NOC ADMINISTRATOR GUIDE Important! To successfully connect, you mu st enter the passcodes in CC-NOC within five minutes after they are gener ated on CC-SG. This will min i mize the window of opportunity for intruders to breach the system with a brute-force attack.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 27 Important! Configuring these mappings is required in order for remote authentication to work. Although you may have several CC-SG’s connected to this CC-NOC via a secure connection, only one can be the remote authentication and authorization source.
28 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Forwarding This page allows you to configure the events, for example, SNMP traps you want forwarded t o external systems. It also allows y ou to configur e the external systems to forward the events to.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 29 address or a hostname that this appliance can resolve. Example: Protocol=Trap, Host= 192.168.51.1 50, Port=162. 8. Type protocol, host, and port for the Path Back URL which is the IP address or hostname of this CC-NOC.
30 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Configure Trap Relaying . Figure 31 Configure Trap Relaying 4. Click add recipient . Figure 32 Specifying Trap Recipient 5. Specify a hostname that is resolvable from this appliance or an IP address in the Host field.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 31 Edit Performance Thresholds (Per Device) In addition to configuring perform ance values per category–see section Configure Performance Thresholds earlier in this chapter, you can also conf igure performance thresholds on a per-device basis.
32 COMMANDCENTER NOC ADMINISTRATOR GUIDE Administrator Tools Administrator tools help you diagnose and fix pr oblem s with the CC-NOC. These tools allow you to backup configuration files, download logs, check the disk usage of your CC-NOC, and establish connections to Techni cal Support.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 33 3. Click Check Disk Utilization on Appliance . Figure 37 Check Disk Utilization on Appliance The Disk Usage section lists the current free space p ercentages for different areas of the storag e within the CC-NOC appliance.
34 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Type a description of the problem you are experiencing in the text box. 5. Type an email address in Confirmation Email: so that when the incident report em ail i s received, you will get a confirmation message.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 35 Download Data Archives Every 24 hours, the previous day’s events are pl aced into an event archival file and made accessible.
36 COMMANDCENTER NOC ADMINISTRATOR GUIDE All CC-NOC patches and updates are made availabl e on a web server which can be automatically checked by your CC-NOC applian ce. If new patches/updates are av ailable, they can also be automatically downloaded, and optionally, autom a tically applied.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 37 4. Click Install Updates . Figure 44 Install Updates 5. Click install to install any of the updates that are lis ted. If an update is listed as downloading, it will be available for installation once it is fully downloaded.
38 COMMANDCENTER NOC ADMINISTRATOR GUIDE available, yet do not want them automatically installed, set Auto Download to enable , but l eave Auto Install configured as disabled . 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration .
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 39 Appliance Database Administration This page allows you to clean out unnecessary or unused infor mation stored in the database, including node information, events, outages, etc. These operations are necessary if you would like to purge some of the data and start over with a clean database.
40 COMMANDCENTER NOC ADMINISTRATOR GUIDE 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration . 3. Click Data Backup and Restore. 4. Click Download Backup Files. Figure 49 Download Backup Files 5. Click a file to begin the download.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 41 2. Click Advanced Administration . 3. Click Manage Routes. Figure 51 Manage Routes 4. To delete a user-defined static route, click remove in the row of the unwanted route .
42 COMMANDCENTER NOC ADMINISTRATOR GUIDE Delete Management Settings and Data This page gives you a way to completely reset th e appliance to nearly a "factory default" state, deleting all collected informati on and configuration s ettings. Warning! This action is irreversible.
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 43 3. Click Delete Traffic Analysis Performance Information. Figure 55 Delete Traffic Analysis Perform ance Data 4. Choose the appliance on which to delete the performance data . 5. Click delete . Install CC-NOC License This page allows you to upload a new license f ile to the CC-NOC.
44 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: In a distributed environment, to insta ll a license for a CC-NOC 2500M or CC-NOC 2500S, from the CC-NOC 2500N click on the Admin tab, click Upload Appliance Licenses , and click load new appliance license .
C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 45 Chapter 3: Configuring Intrusion Detection This chapter describes procedures to configure a CC-NOC so it can monitor and analyze system events for attempts to access system resources in an unauthorized manner.
46 COMMANDCENTER NOC ADMINISTRATOR GUIDE Deployment Place the Ethernet TAP on the Ethernet cable in the same location where an Ethernet hub would be used. The Ethernet tap has the exact same function as the hub, except that one of the ports is uni-directional and outputs data that is passing over th e wire.
C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 47 4. Choose the appliance that you wish to configure by clicking Configure next to i t. Figure 60 Configuring Home Network for Intrusion Detection Appliance 5. To include an entire subnet in your home network, use the Add Addresses box.
48 COMMANDCENTER NOC ADMINISTRATOR GUIDE All of the Intrusion Detection appliances that can communicate with this system are listed in the box. The Last Change field indicates the last tim e that the home network for the appliance was changed. Figure 61 Selecting an Intrusion Detect ion Appliance for Portscan Detection 4.
C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 49 Determining which ports are open on a target machin e is often the first step towards a successful attack on a network system. Attackers genera lly use port scanning utilities to probe a target system and make a list of all open ports on the devi ce.
50 COMMANDCENTER NOC ADMINISTRATOR GUIDE Select Intrusion Detect ion Appliance(s) All of the Intrusion Detection appliances that can communicate with the system hosting this Web Console are listed in the Intrusion Detection Appliance box.
C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 51 Select Types of Signatures to Monitor When in doubt, enable detection. There is no di sadvantage to enabling extra detection, except that you may receive extraneous events from your Intr usion Detection applian ces.
52 COMMANDCENTER NOC ADMINISTRATOR GUIDE Load Default Signatures or Settings from Another Appliance Alternatively, you can quickly configure your I ntrusion Detection appliance by selecting a set of pre-selected signatures appropriate for most ne tworks or by selecting a previously saved appliance’s signature settings.
C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 53 Advanced Intrusion Detection Administration Advanced administration assists in fine tuning the set of signatures that an intrusion detection application will use to detect intrusion traffic on the network.
54 COMMANDCENTER NOC ADMINISTRATOR GUIDE Upload Custom Signatures Tool The Upload Custom Signatures page allows you to upload a s pecific set of rules that will be sent to a specified Intrusion Detection appliance.
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 55 Chapter 4: Configuring Windows Management This chapter describes procedures to configure a CC-NOC so it can use Microsoft’s WMI (Windows Management Instrum entation) to monitor and manage Windows servers and workstations in your network.
56 COMMANDCENTER NOC ADMINISTRATOR GUIDE External Proxy Host Requirements For best results, it is recommended to use Window s XP Professional, Service Pack 2 (or later) with auto updates enabled to facilitate co mmunications between CC-NOC and the managed systems.
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 57 4. Unzip the ProxyInstaller archive on your Windows machine and move the directory to a location where you would like to keep the pr ogram . For example, a good location could be: C:Program FilesRaritanProxyInstaller 5.
58 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Windows Management Configuration Wizard is an interface to specify and configure proxy hosts, which facilitate connectivity between the CC-NOC and your managed Windows servers and workstations.
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 59 6. Type the IP address for the proxy host. This should be the same host that the configuration tool was run – see section Download and Run earlier in this chapter for additional information. Note: Hostname values in this field must be resolvabl e via DNS or must be a numeric IP address.
60 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: After windows discovery process is complete, you may notice an overlap in devices that were specified in the Discovery Range – please see Edit Discovery Ranges in Chapter 2: General and Advanced Administration for additional information.
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 61 Note: Any local user defined must be a member of th e Local Administrators group to authenticate and allow data collection to occur.
62 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configuring a WINS Se rver or LMHOSTS File If you need to collect WMI data from Windows se rvers that exist in another network and you need to resolve Windows NetBIOS names to IP a ddresses, on the external proxy you can either: • Configure the WINS server.
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 63 8. Click on the WINS tab. Figure 77Selecting WINS Tab 9. Click the Add… button and specify the address of the WINS server for the remote appliance to use for Windows computer name resolution and click add .
64 COMMANDCENTER NOC ADMINISTRATOR GUIDE Authenticate Windows Computers This option allows you to change t he authenti cation usernames and passwords for discovered servers and workstations. 1. Click on the Admin tab in the top navigation bar. 2. Click Windows Management Configuration .
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 65 5. Choose the desired operation, for example, change license type to Promoted Workstation . 6. Click submit . To generate an inventor y report of the current list of devices, select an output format, for example, HTML or XML, and click generate report .
66 COMMANDCENTER NOC ADMINISTRATOR GUIDE To edit WINS settings: 1. Click on the Admin tab in the top navigation bar. 2. Click CommandCenter NOC 2500M Configuration . Figure 81 Edit WINS Settings 3. Select the CC-NOC 2500M appliance from the pull-down menu next to edit WINS settings .
CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 67 Edit LMHOSTS File To resolve Windows NetBIOS names to IP addresses, you can edit the lmhosts file if you are using the internal proxy on the CC-NOC 2500M a ppli ance and a WINS server is not available. 1.
68 COMMANDCENTER NOC ADMINISTRATOR GUIDE 5. Specify the IP address of each remote Windows server from which you wish t o collect WMI data. 6. You can also delete all of the lmhosts settings for the appliance by clicking delete LMHOSTS file . 7. Click submit changes .
CHAPTER 5: CONFIGURING VULNERABI LI TY SCANNING 69 Chapter 5: Configuring Vulnerability Scanning This chapter describes procedures to configure a CC-NOC so it can scan for vulnerabilities, for example, exploits and thresholds against devices within your network.
70 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Read the warning and at the bottom of the page, click I Agree. By clicking on I Agree and proceeding to the configuration page, you acknowledge these risks and take responsibility for all potential dam ages and outages.
CHAPTER 5: CONFIGURING VULNERABI LI TY SCANNING 71 Scan Level 4 Scan Level 4 performs all checks of previous levels and also attempts exploits that are known to be directly harmful to target systems. These incl ude vulnerabilities that can alter data on the target or bring down services or the operating system by using denial-of-service techniques.
72 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add to have the targets added, or excluded, from the scan. 4. Click save settings to save all addresses entered and return to the previous page. 5. Scroll to the bottom of the page and creat e a scanning schedule.
CHAPTER 6: CONFIGURING NOTIFICATIONS 73 Chapter 6: Configuring Notifications This chapter describes procedures to configure a CC -NOC so it can send and escalate notices through email, pagers, etc.
74 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Notifications By configuring event notifications, each system event can be configured to send a notific ation whenever that event is triggered. 1. Click on the Admin tab in the top navigation bar.
CHAPTER 6: CONFIGURING NOTIFICATIONS 75 Select Event Type The first step when adding or editing a notification is to select one event type to associate with the notification. Notice that if you are adding a new not ice for an existing even t, you will bypass this step.
76 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Click one of the radio buttons: • To NOT build a rule, click Do not constrain notice against interface or service. • To build a rule, click Send notice only if it contains an interface that matches the interface/service rule below.
CHAPTER 6: CONFIGURING NOTIFICATIONS 77 8. If you do not wish to validate the rule or did not define an interface/service rule, click skip results validation to continue.
78 COMMANDCENTER NOC ADMINISTRATOR GUIDE and will also appear in the Notification Browser as described in Raritan’s CC-NOC User Guide . 15. Type an Email Subject that will appear as the subject of the email sent as a result of this Event Notification.
CHAPTER 6: CONFIGURING NOTIFICATIONS 79 notification path – please see section Configure Notification Paths later in this chapter for additional information. Note: To assign users to a group, the users mu st be pre-defined – please see section Add a New User in Chapter 8: Creating Users, Categories, Views for additional information.
80 COMMANDCENTER NOC ADMINISTRATOR GUIDE Figure 99 Assigning Users to a Notification Group 5. Type in comments that describe the group. This is optional. 6. Assign users to the group by clicking select all , or Ctrl+click to select more than one user, or hold down the Shift key and click on the opposing end to select a range of users.
CHAPTER 6: CONFIGURING NOTIFICATIONS 81 Configure Notification Paths In this section, you will create notification paths that defines the users or groups who will receive notifications, how the notifications will be sent, fo r example, numeric or text pagers, email, and who to notify if escalation is needed.
82 COMMANDCENTER NOC ADMINISTRATOR GUIDE Create New Path Name a nd Specify Targets In this step, you need to specify a new name and select a target, that is, user, group, or email. Figure 101 Configuring a Notification Path To create a new notification path: 4.
CHAPTER 6: CONFIGURING NOTIFICATIONS 83 • For Group Target , select only one group as previously defined, please see section Configure Notification Groups earlier in this chapter for details, and specify an interval, that is, minutes, hour, or da ys, to indicate how long to wait before sending the notification t o users in this group.
84 COMMANDCENTER NOC ADMINISTRATOR GUIDE Define Escalation i n Notification Path In this step, you need to define how l ong the CC-NOC will wait until it sends a subsequent notification after sending out the first one. You als o need to specify who will be receiving this subsequent notification.
CHAPTER 6: CONFIGURING NOTIFICATIONS 85 • For Group Target , select only one group as previously defined, see section Configure Notification Groups earlier in this chapter for additiona l information, specify an interval, that is, minutes, hour, or da ys, to indicate how long to wait before sending the notification t o users in this group.
86 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure TAP Paging This section explains configuring the Telocator Alphanumeric Protocol (TAP) for a specific paging service provider. This allows the CC-NOC to send notifications to us ers' pagers if the appliance has its modem connected to a telephone line.
CHAPTER 6: CONFIGURING NOTIFICATIONS 87 Add a new TAP Service In this step, you need to enter the phone numbe r, b aud rate, and other information for a TAP service.
88 COMMANDCENTER NOC ADMINISTRATOR GUIDE Edit Modem Parameters In this step, you will set up the m odem paramete rs. If your modem requires special parameters for initialization or dialing prefixes, such as dialing "9 " to get an outside line, you’ll need to enter these parameters.
CHAPTER 7: M ANAGI NG A SSETS 89 Chapter 7: Managing Assets This chapter describes procedures to configure a CC-NOC so it can track and share important information about capital assets in your organizati on.
90 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Import Assets . Figure 114 Importing assets 4. Paste your comma-separated values into this text field to import them into the assets database. There is one line per record, and the fields are delimited by commas.
CHAPTER 7: M ANAGI NG A SSETS 91 Export Assets All the nodes with asset inf ormat ion ca n be e xported to a co mma-separated value file ( CSV), whic h is s uitabl e f or use in a spreadsheet app lication. If you do an import into the CC-NOC with this CSV file , you will be asked to re-map all assets that were previously mapped to a node.
92 COMMANDCENTER NOC ADMINISTRATOR GUIDE Clear All Asset Records This allows you to remove all asset records from the CC-NOC. Be sure to export the assets if you ever need to recover this data in the future. If you are rebuilding the asset records from an export via the CC-NOC, you will need to clear the asset ta ble prior to re-importing.
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 93 Chapter 8: Creating Users, Categories, Views This chapter describes procedures to add users, delete and modify users, build views, and create categories. Build your own custom way of looking at your network, called views, and then assign them to your users.
94 COMMANDCENTER NOC ADMINISTRATOR GUIDE • Operators have access to every thing on the CC-NOC except administrative configurations. • Executive User have read-only access to only a few ke y reports that show the network health at a high level.
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 95 5. Supply a full name and enter comments. This is optional. 6. If desired, provide Executive User Constraints to provide an executive-level user acce ss only to the specified category and appliance that is specified.
96 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Choose the start time and stop time from the select boxes. If a user works a shift that spans midnight you will have to enter two duty schedules. One from the st art of the shift till midnight, and the second on the next day from midnight till the end of the shift.
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 97 Web Servers Includes all managed interfaces which are running an HTTP (web) server on port 80 or other common ports. Categories can then be combined into views , providing you t he ability to focus users on the nodes that are pertinent to their role.
98 COMMANDCENTER NOC ADMINISTRATOR GUIDE 7. Specify either IP addresses/ranges or services th at will be included in this category. The category will be populated with those nodes/servi ces that you define here so you can design customized views for your us ers.
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 99 Configure Views Configuring views allows y ou to create a ma pping between users and views, or sets of categories, they will see when logging into the CC-NOC. Views are simply the combination of categories that your users will see when logging in.
100 COMMANDCENTER NOC ADMINISTRATOR GUIDE Add/Modify an Existing View In this page, you can add a new view or modify an existing one, including adding or rem oving sections, for example, logical groupi ngs of categories under a common heading, as well as the categories within them.
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 101 Map Users After creating views, you c an now ma p user s to a view that will be displayed after they log into the CC-NOC. If users are not mapped to a specific vi ew, then the Default view that was selected in section Configure Views will be displayed.
102 COMMANDCENTER NOC ADMINISTRATOR GUIDE.
APPENDIX B : TROUBLESHOOTING 103 Appendix A: Specifications V1 Platform General Specifications Form Factor 1U Dimensions (DxWxH) 24.21”x 19.09” x 1.
104 COMMANDCENTER NOC ADMINISTRATOR GUIDE N ON -O PERATING Temperature -40 - +60 (-40-140) Humidity 5% - 95% RH Altitude Operate properly at any altitude between 0 to 10,000 feet, storage 40,000 feet (Estim ated) Vibration 5-55-5 HZ, 0.
APPENDIX B : TROUBLESHOOTING 105 Appendix B: Troubleshooting Raritan wants to be involved from the beginning of your deployment and throughout the entire lifetime of your use of Raritan products.
106 COMMANDCENTER NOC ADMINISTRATOR GUIDE Checking Appliance Database Settings From time to time, you may see this message: It is recommended you contact Technical Support, who can then request SSH access to yo ur appliance. You can allow this access and open an SSH connection by clicking the establish support connection button.
APPENDIX B : TROUBLESHOOTING 107 Capability Scanning The capability scanning service scans individual no des to discover which services are supported on that node. It uses an intelligent service discovery mechanism and relies heavily upon communication over the TCP protocol (and sometimes UDP).
108 COMMANDCENTER NOC ADMINISTRATOR GUIDE The notifications service does not generate any events; it only react s to them. It does, however, save its history in the database so that you can review past notifications. SNMP Data Collection The SNMP data collection service collects additi onal data from nodes that support SNMP.
APPENDIX B : TROUBLESHOOTING 109 Your Network Understanding and maintaining your network is the key to success. The Raritan services will help you understand and troubleshoot yo ur network, as it relates to the CC-NOC. This chapter, however, is about troubleshooting the C C-NOC.
110 COMMANDCENTER NOC ADMINISTRATOR GUIDE If you are confident that the CC-NOC can ping the node in question, the next step is to confirm that the CC-NOC has discovered a device correctly. Check the following things: If the ping was successful, the CC-NOC will generate a suspect node event.
APPENDIX B : TROUBLESHOOTING 111 the Admin tab, Network Management , and Configure Pollers . For each service that responds during the intelligent service scan, the system will generate a “Node Gained Service” event. The text of this event will look like the following: The X service has been discovered on interface WWW.
112 COMMANDCENTER NOC ADMINISTRATOR GUIDE Why Can’t My CC-NOC Manage X Service? ICMP - If a device respon ds to a "ping", which uses IC MP fo r its transport, the device w ill b e flagged as supporting ICMP and will be tested for ICMP availability on the standard polling interval.
APPENDIX B : TROUBLESHOOTING 113 If a service successfully connects, but otherwise "fails", a "service unresponsive" event is generated. An example of this would be a poller sends a TCP connect request… and gets a connecting, but within the “timeout” period there is no response.
114 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Management group receives notifications for any default notifications sent to the Network/Systems, Windows Management, or Secu rity groups. Any notification sent to these groups is given, by default, a 15 m inute window for acknowledgement.
APPENDIX B : TROUBLESHOOTING 115 Of these five, Raritan only uses three: • GET - A message sent from the Manager to the Agent requesting information • GET RESPONSE – The message the Agent sends .
116 COMMANDCENTER NOC ADMINISTRATOR GUIDE In most cases, if the CC-NOC is not col lecting data from a particular device, it’s usually because of a misconfiguration on the rem o te device. Often, incorrect community strings are the culprit, or the SNMP service has not been turn ed on or configured correctly.
APPENDIX B : TROUBLESHOOTING 117 from the CC-NOC to the device and that TC P and UDP are working. If you have already performed the troubleshooting steps for Pollers a nd Capability Scanning on the node in question, you have adequately tested this. If you are ha ving tr ouble with vulnerability scanning, try the troubleshooting steps below: 1.
118 COMMANDCENTER NOC ADMINISTRATOR GUIDE SNMP, used for collection performance dat a for re porting, is still considered a service and a s s uch , if a poll fails, it will still generate an outage that is integrated with the notification system. To determine if an interface supports SNMP, ch eck the appropriate Interface page for that node.
APPENDIX B : TROUBLESHOOTING 119 • If you are a reseller seeking technical resources, please send an email to tech@raritan.com . • For technical support, call the number as stated in the front of this document. Note that Technical Support is intended to provide resellers and customers with technical assistance if necessary.
120 COMMANDCENTER NOC ADMINISTRATOR GUIDE.
APPENDIX C : PERFORMANCE MONITORING 121 Appendix C: Performance Monitoring Overview The CC-NOC is designed to provide you with the information necessary to support critical decisions in your environment.
122 COMMANDCENTER NOC ADMINISTRATOR GUIDE Equipment Vendor Device Type Metric(s) Relevance All Any device supporting MIB2 (RF 1213) In/Out Octets In/Out Discards In/Out Errors Provides basic information on the network traffic that an interface has transmitted/received.
APPENDIX C : PERFORMANCE MONITORING 123 Checkpoint Firewall products State information stored Process Contexts Allocated storage CPU Utilization Packets accepted Packets rejected Packets dropped Packets logged This information is critical for the firewall administrator making sizing or upgrade decisions on firewalls.
124 COMMANDCENTER NOC ADMINISTRATOR GUIDE Cisco Network gear CPU Utilization Free Memory Buffer failures Buffer memory allocation failures Provides insight as to router sizing and performance, especially as augmented by MIB2 data.
APPENDIX C : PERFORMANCE MONITORING 125 Memory In Use Free Physical Memory Total Logical Memory Logical Memory In Use Percent Logical Memory In Use Free Logical Memory Memory Pages per Second 1 underpowered devices.
126 COMMANDCENTER NOC ADMINISTRATOR GUIDE on demand. The remaining item is determining when performance metrics have reached a point at which they should be acted upon.
APPENDIX C : PERFORMANCE MONITORING 127 Example Here’s an example. There is a high thr eshold set with a value of 70, a trigger of 3, and a rearm of 55. A new value is generated every minute. The first reported value is 65, which is less than our high threshold of 70, so no action is taken.
128 COMMANDCENTER NOC ADMINISTRATOR GUIDE Windows Performance Metric Thresholds The following values apply to data reported by Windows boxes. Note that there are separate events for Workstations and Server s – this is due to what data points Microsoft reveals.
APPENDIX D : SETTING UP WMI ON TARGET MACHI NES 129 Appendix D: Setting up WMI on Target Machines Configuring a Windows 98/ ME box for Remote WMI Management The ability of the CC-NOC to manage Windows 98 and Windows ME systems is lim ited by the design of the Windows platform .
130 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Add the machine to the domain using t he cont rol panel, network settings by doing the following: • Start->Settings->Control Panel->Network. • Select Client for Microsoft Networks from the tab.
APPENDIX D : SETTING UP WMI ON TARGET MACHI NES 131 Note: Using Windows 98/ME, XP Home, or any NT 4. 0 system is not recommended or supported as a proxy system. Additionally, although Servers ar e supported, it is not adv isable to utilize them as your proxy due to error logging issues.
132 COMMANDCENTER NOC ADMINISTRATOR GUIDE.
APPENDIX E : MANAGING AND RESPONDING TO INT RUSION DETECTION EVENT S 133 Appendix E: Managing and Responding to Intrusion Detection Events This appendix is intende d to provide a little insight as to .
134 COMMANDCENTER NOC ADMINISTRATOR GUIDE as to whether or not new signatures should be applied to a given CC-NOC. This reduces your workload, while automating the most difficult part of intrusion detection—keeping it u p-to-date.
APPENDIX E : MANAGING AND RESPONDING TO INT RUSION DETECTION EVENT S 135 • Are all of your systems at the most recent revision of operating system and patch • level? Patches and hot-fixes are extremel y important for Microsoft platforms.
136 COMMANDCENTER NOC ADMINISTRATOR GUIDE.
APPENDIX F : NOTIFICATION PARAMETERS 137 Appendix F: Notification Parameters Notification Parameter Substitution The notification subsystem is very robust and flexible, allowing the appropriate notification of the appropriate personnel at the appropriate ti me.
138 COMMANDCENTER NOC ADMINISTRATOR GUIDE %event[parm[name]]% replaced by the valu e of the parameter named 'name', if p resen t %event[parm[##]]% replaced by the total number of parameters .
APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 139 Appendix G: Network Tr affic Overhead: Network Management’s Necessary Evil On five-minute intervals, the CC -NOC polls services on managed nodes using Raritan's 's yn th eti c transactions'.
140 COMMANDCENTER NOC ADMINISTRATOR GUIDE CK-ACK three-way handshake, which when comple ted, indicates that the por t is listening and accepting connections. This handshake is a pre-cu rsor to any TCP session and is also embedde d within most other sy nthetic transaction s, including HTTP, which we'll discuss late r.
APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 141 host, and an additional five metrics per managed interface. The host used in this example has two interfaces, so the results reflect metrics f or a se cond interface as well as the de facto first interface.
142 COMMANDCENTER NOC ADMINISTRATOR GUIDE In addition to polling overhead, our services scan wi ll run less than once a day and gen erate traffi c roughly equivalent to a single po lling interval. If vuln erability scanning is en ab le d, th e CC -N OC will also generate the traffic associated with comp leting those tests.
APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 143 255-80-5301-00.
World Headquarters Raritan Computer, Inc. 400 Cottontail Lane Somerset, NJ 08873 USA Tel. (732) 764-8886 Fax (732) 764-8887 Email: sales@raritan.com www.raritan.com Rari t an OEM Di visio n Peppercon USA, Inc. 111 E. Wacker Dr, Suite 2626 Chicago, IL 60601 Tel.
Un point important après l'achat de l'appareil (ou même avant l'achat) est de lire le manuel d'utilisation. Nous devons le faire pour quelques raisons simples:
Si vous n'avez pas encore acheté Raritan Computer NOC c'est un bon moment pour vous familiariser avec les données de base sur le produit. Consulter d'abord les pages initiales du manuel d'utilisation, que vous trouverez ci-dessus. Vous devriez y trouver les données techniques les plus importants du Raritan Computer NOC - de cette manière, vous pouvez vérifier si l'équipement répond à vos besoins. Explorant les pages suivantes du manuel d'utilisation Raritan Computer NOC, vous apprendrez toutes les caractéristiques du produit et des informations sur son fonctionnement. Les informations sur le Raritan Computer NOC va certainement vous aider à prendre une décision concernant l'achat.
Dans une situation où vous avez déjà le Raritan Computer NOC, mais vous avez pas encore lu le manuel d'utilisation, vous devez le faire pour les raisons décrites ci-dessus,. Vous saurez alors si vous avez correctement utilisé les fonctions disponibles, et si vous avez commis des erreurs qui peuvent réduire la durée de vie du Raritan Computer NOC.
Cependant, l'un des rôles les plus importants pour l'utilisateur joués par les manuels d'utilisateur est d'aider à résoudre les problèmes concernant le Raritan Computer NOC. Presque toujours, vous y trouverez Troubleshooting, soit les pannes et les défaillances les plus fréquentes de l'apparei Raritan Computer NOC ainsi que les instructions sur la façon de les résoudre. Même si vous ne parvenez pas à résoudre le problème, le manuel d‘utilisation va vous montrer le chemin d'une nouvelle procédure – le contact avec le centre de service à la clientèle ou le service le plus proche.
